Privacy policy

At Xtalvi we are committed to protecting your privacy. This policy describes what data we collect, what we use it for, and your rights under the GDPR.

Data controller

The data you enter in the app (expenses, tags, folders, friends, receipt photos) is processed by the controller identified below to provide the service to you.

Controller: Pol Monleón Vives
Tax ID: 26068795C
Address: Carrer dels Assaonadors 19, 1º1ª
Email: polmonleonvives@gmail.com

Data we process

Account data (email, name if provided), expenses and related data (amount, date, tag, folder, comment, optional photo), relationships with other users when you share expenses, and preferences (language, notifications). We do not sell or share your data with third parties for marketing.

Purpose

To provide the personal and shared expense management service, send you notifications and summaries you have agreed to, and comply with legal obligations.

AI chat

If you use the app's chat assistant, your messages and the data needed to generate the response (for example, your expenses or categories) are processed by external artificial intelligence providers (OpenAI and Groq), who act as data processors. This data may be processed outside the European Economic Area, under appropriate safeguards (standard contractual clauses). Your conversations are not used to train third-party models.

Legal basis for processing

We process your data on the following legal bases: performance of the service contract (registration, expenses, shared expenses, subscriptions), compliance with legal obligations (invoicing, tax), and your consent for sending notifications, summaries and communications you have agreed to, which you can withdraw at any time.

Retention period

We keep your data for as long as your account remains active. If you request deletion of your account, we remove your personal data, except information we must retain due to legal obligations (for example, billing data for the periods required by tax and commercial regulations).

Recipients and data processors

To provide the service, we share certain data with providers acting as data processors: Stripe (payment and subscription processing) and Google (sign-in via OAuth). On the free version of the app, Google AdSense also shows ads and may process advertising identifiers based on your consent, which you can manage or withdraw at any time from the app. These providers may be located outside the European Economic Area; in such cases, the transfer takes place under appropriate safeguards under the GDPR, such as the European Commission's Standard Contractual Clauses. We do not share your data with third parties for our own marketing purposes.

Sign in with Google

If you choose to continue with Google, we use Google (Google LLC) as an authentication service. Google only shares your email address and profile name with us ("email" and "profile" scopes). We do not access your contacts, Gmail, Drive or any other data in your Google account, and we do not keep the Google access token. Before creating your account we ask you to confirm that you are 16 or older; if you say you are not, we store no data and revoke the access granted to Xtalvi.

Minimum age

Xtalvi is not intended for people under 16. To check this we only store that you confirmed it and when; we do not store your date of birth. If we learn that an account belongs to someone under 16, we delete it.

Emails

We send you emails required for your account (activation, password recovery, subscription notices) and non-essential emails (a monthly reminder of premium benefits and notices about available reports). You can unsubscribe from non-essential emails at any time via the link in each email or from your profile.

Push notifications

If you allow notifications in your browser or device, we store a Firebase Cloud Messaging (Google) device identifier to send them. You can turn them off at any time from your browser or profile.

Location and maps

If you allow access to your location when recording an expense, the app queries OpenStreetMap's Nominatim service to get the city name, and the expense map loads map images from OpenStreetMap. These services, provided by the OpenStreetMap Foundation (United Kingdom), receive your IP address and, for Nominatim, the expense coordinates.

Usage statistics

We record usage events linked to your account (for example, signing in or creating an expense) on our own servers to improve the service. We do not use session recording, heatmaps or third-party analytics services. These records are deleted when you delete your account.

Account deletion

You can delete your account and your data at any time from the app profile. Accounts with no activity for 12 months are deleted automatically, and email sign-ups that are not activated within 24 hours are also deleted.

Your rights

You can access your data in the app, correct it at any time, object to certain processing, request restriction of processing, request portability of your data, and request deletion of your account (all your data will be removed). Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand. If you have outstanding debts, settle them before closing your account. To exercise your rights or for any queries, contact us. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you believe the processing of your data does not comply with the regulations, via www.aepd.es.

Contact

For any privacy questions or to exercise your rights, contact us at the email address shown in the app or on this website.